Snipe Snipe-It vulnerabilities

CVE-2025-15602 [HIGH] CWE-915 Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious

CVE-2026-37709 [CRITICAL] CWE-284 Snipe-IT has insecure permissions in file uploads Snipe-IT has insecure permissions in file uploads Insecure Permissions vulnerability in grokability snipe-it versions through 8.4.0, fixed after 2026-03-10 commit 676a9958, allow a remote attacker to execute arbitrary code via the `app/Http/Controllers/Api/UploadedFilesController.php` component ### Impact Users who can view assets, consumables, etc were able to send a POST request to `/api/v1/{object_type}/{id}

CVE-2026-44832 [HIGH] CWE-281 Snipe-IT has Privilege Escalation via API Permissions Assignment Snipe-IT has Privilege Escalation via API Permissions Assignment ### Impact An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user

CVE-2022-23064 [HIGH] CWE-74 CVE-2022-23064: In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a spe In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.

CVE-2023-5452 [MEDIUM] CWE-79 Cross-site Scripting in snipe/snipe-it Cross-site Scripting in snipe/snipe-it Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.

CVE-2022-0611 [HIGH] CWE-269 Improper Privilege Management in Snipe-IT Improper Privilege Management in Snipe-IT An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.

CVE-2026-54329 [HIGH] CWE-74 Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection ### Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body. The issue oc

CVE-2024-5685 [HIGH] CWE-862 CVE-2024-5685: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

CVE-2026-55516 [HIGH] CWE-639 Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update ### Impact The API endpoint for updating asset maintenance records allows an authorized user to change the asset_id of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or m

CVE-2026-55466 [MEDIUM] CWE-79 Snipe-IT vulnerable to stored XSS via inline-served attachment Snipe-IT vulnerable to stored XSS via inline-served attachment ### Impact A low-privilege user can store an active-content payload as an asset attachment and have it served inline, same-origin, with an active Content-Type, achieving stored XSS. The application sanitizes uploads only when PHP finfo detects image/svg+xml. By submitting an XHTML document whose finfo MIME is text/xml (an allowed extension)

CVE-2025-59713 [MEDIUM] CWE-502 Snipe-IT allows unsafe deserialization Snipe-IT allows unsafe deserialization Snipe-IT before 8.1.18 allows unsafe deserialization.

CVE-2026-55643 [HIGH] CWE-863 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode ### Impact Due to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company (company_id = null). While direct instance authorization (isCurrentUserHasAccess) correctly denies access to these out-of-scope users, multiple API endpoints and bulk action web route

CVE-2026-55474 [HIGH] CWE-23 Snipe-IT vulnerable to directory traversal in displaySig Snipe-IT vulnerable to directory traversal in displaySig ### Impact The `displaySig` action in `ActionlogController` serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the

CVE-2026-55452 [MEDIUM] CWE-1236 Snipe-IT has CSV formula injection in Activity Report export Snipe-IT has CSV formula injection in Activity Report export ### Impact In Snipe-IT v8.6.1 and lower, `Actionlog::logaction()` stores the request User-Agent header in user_agent. That value is later included in the Activity Report CSV export by `ReportsController::postActivityReport()` and written with plain `fputcsv()`. A low-privileged authenticated user can set a formula-like User-Agent, perform a

CVE-2024-48987 [HIGH] CWE-1393 Snipe-IT remote code execution Snipe-IT remote code execution Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

CVE-2026-55469 [LOW] CWE-22 Snipe-IT has a path traversal vulnerability via CSV import `image` field Snipe-IT has a path traversal vulnerability via CSV import `image` field ### Impact An authenticated user holding the `import` and `assets.update` permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's `image` field via CSV import, then triggering the image deletion feature.

CVE-2026-55460 [HIGH] CWE-863 Snipe-IT has an authorization bypass on bulk editing users Snipe-IT has an authorization bypass on bulk editing users ### Impact An authenticated non-admin user with `users.view` and `users.edit`, but without `users.delete`, can directly POST to `/users/bulksave` and soft-delete another non-admin user. The UI and confirmation route require `users.delete`, but the destructive sink only authorizes `update`. ### Attacker Model Authenticated non-admin user with: ~~~

CVE-2024-51093 [HIGH] CWE-79 Cross Site Scripting vulnerability in Snipe-IT Cross Site Scripting vulnerability in Snipe-IT Cross Site Scripting vulnerability in Snipe-IT v.7.0.13 allows a remote attacker to escalate privileges via an unknown part of the file /users/{{user-id}}/#files.

CVE-2026-48492 [MEDIUM] CWE-862 Snipe-IT's selectlist visibility is too permissive Snipe-IT's selectlist visibility is too permissive ### Impact The GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user

CVE-2026-49870 [MEDIUM] CWE-770 Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` ### Impact `POST /two-factor` had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guesses. The TOTP implementation accepts the current code plus one step on either side (`config/google2fa.php window=1`), so at any instant 3 of 1,000,00